wicked-crew 0.13.2 → 0.14.0

package/dist/api/routes.js

@@ -30,6 +30,7 @@ import { SeatContainerStatus, isContainerLoginCli, isContainerSeatFloor, loginDe
 import { ChatTurnIndex } from './chat-turns.js';
 import { ChatScopeIndex, chatScopeDeps, chatScopeStatement, prepareChatScratch, removeChatScratch, namedKindRefusal, resolveChatScope, } from './chat-scope.js';
 import { ASK_TURN_BUDGET_SECS, AskPathIndex, answerStep, isAskTurn } from './ask-paths.js';
+import { reassignRefusedSeats } from '../core/reassign-refusal.js';
 import { allowedRootsFor, isInsideRoot, openWithSystemDefault } from './open-path.js';
 import { InvalidDiffBaseError, MERGE_BASE_LITERAL, NotARegularFileError, UnresolvableDiffBaseError, branchDiff, isGitStopped, isPlainRef, readFileCapped, worktreeDiff, } from './run-files.js';
 import { DocRunIndex } from '../interactive/doc-run-index.js';
@@ -99,7 +100,7 @@ import { LOCAL_ACTOR, trustAtLeast } from './auth.js';
 // value lives in the leaf module api-prefix.ts to keep unit-output.ts out of this file's cycle.
 export { API_PREFIX } from './api-prefix.js';
 import { API_PREFIX } from './api-prefix.js';
-import { landPolicyRule, policyProposalToRule } from './policy-landing.js';
+import { landPolicyRule, policyProposalToRule, withdrawLandedRule } from './policy-landing.js';
 import { DecisionError, DecisionService } from '../decisions/land.js';
 import { ingestDecision } from '../decisions/ingest.js';
 import { registerDecisionRoutes } from '../decisions/routes.js';
@@ -548,6 +549,22 @@ export const RetireMemorySchema = z.object({
 export const RetireMemoryItemSchema = z.object({
     memory_id: z.string().min(1).max(512),
 }).strict();
+/** `POST /memory/edit` body (wicked-studio's Memory page): ONE memory's new words. `.strict()`: an
+ *  unknown field is a 400, never read as something wider than one memory. */
+export const EditMemorySchema = z.object({
+    memory_id: z.string().min(1).max(512),
+    content: z.string().min(1).max(4000),
+}).strict();
+/** estate `memory.capture`'s `kind` for a tier — the kind natural to it, as estate's own proposal
+ *  approve picks (`kind_for_tier`), so an edited memory keeps the kind its tier implies. */
+const KIND_FOR_TIER = {
+    working: 'working', episodic: 'episode', semantic: 'fact', procedural: 'skill', archival: 'archive',
+};
+/** The id `POST /memory/edit` probes erase-by-id with: no memory carries it, so the erase deletes nothing. */
+const MEMORY_EDIT_PROBE_ID = 'crew:erase-by-id-probe';
+/** The memory ids with an edit in flight: estate has no compare-and-swap, and two edits of one memory
+ *  racing would each write a copy. One daemon, so one edit per memory at a time is enough. */
+const memoryEditsInFlight = new Set();
 /** The error an estate from before wicked-estate#188 answers to `memory.erase {id}`: it knows only the
  *  subtree erase, so it refuses the call (deleting nothing) for want of a `scope_prefix`. */
 const ESTATE_NO_ERASE_BY_ID = /scope_prefix \(non-empty\) required/i;
@@ -1036,6 +1053,13 @@ runtime = {}) {
             if (isAskTurn(view))
                 view.session.ask_turn = true;
         }
+        // crew#1058: the seats a reassign of each unit is refused for (the work's authors under a
+        // distinct-evaluator contract) — the same rule the reassign route applies. ABSENT when none.
+        for (const unit of view.units) {
+            const refused = reassignRefusedSeats(view, unit.ord);
+            if (refused.length > 0)
+                unit.reassign_refused = refused;
+        }
         return view;
     };
     // Resolved ONCE and shared by the project routes (which read/write `interactiveRoot`) and the
@@ -1572,6 +1596,15 @@ runtime = {}) {
         };
         if (!worktreeLive)
             return fromBranchOr409();
+        // crew#1057: the delivered-worktree sweep (`git worktree remove`) deletes the worktree's files,
+        // its `.git` link among them, BEFORE the directory itself. A bound run's worktree with no `.git`
+        // link is being swept: git run in it finds the registered repo above it instead, and answers
+        // about that checkout (an empty diff) or fails with no named error ("no merge base between
+        // origin/main and HEAD"). Such a worktree is gone, checked before the read and again after it.
+        const bound = resolved.session.repo_ref !== null;
+        const worktreeIntact = () => existsSync(workdir) && (!bound || existsSync(join(workdir, '.git')));
+        if (!worktreeIntact())
+            return fromBranchOr409();
         // Narrowing is WORKTREE-scoped: a contained-but-outside-the-worktree path (extra write
         // root / repo root) is a valid FILE read but has no meaning as a diff pathspec — rejected
         // explicitly here rather than handing git a `../`-prefixed pathspec and surfacing its
@@ -1592,22 +1625,31 @@ runtime = {}) {
         try {
             if (defaultBase !== undefined) {
                 try {
-                    return { ...(await worktreeDiff(workdir, rel, defaultBase)), source: 'worktree', base: defaultBase };
+                    const read = await worktreeDiff(workdir, rel, defaultBase);
+                    if (!worktreeIntact())
+                        return fromBranchOr409();
+                    return { ...read, source: 'worktree', base: defaultBase };
                 }
                 catch (err) {
                     if (!(err instanceof UnresolvableDiffBaseError))
                         throw err;
                 }
             }
-            return { ...(await worktreeDiff(workdir, rel, rawBase)), source: 'worktree' };
+            const read = await worktreeDiff(workdir, rel, rawBase);
+            if (!worktreeIntact())
+                return fromBranchOr409();
+            return { ...read, source: 'worktree' };
         }
         catch (err) {
             // The worktree was removed WHILE this request ran (the delivered-worktree sweep, an engine
             // reap). Whatever git said — a spawn into the vanished cwd fails ENOENT (the 0.9.1 release
             // smoke), a git already running exits 128 "Unable to read current working directory" (the
             // 0.9.3 one) — a diff that failed over a worktree that is gone now serves the run branch, as
-            // for a worktree that was already gone. A named base error stays the caller's 400 (codex r1).
-            if (!(err instanceof UnresolvableDiffBaseError) && !existsSync(workdir))
+            // for a worktree that was already gone. A ref the CALLER named that does not resolve stays the
+            // caller's 400 (codex r1). The `merge-base` literal names no ref: when the worktree is being
+            // swept, its failure is the sweep's, not the caller's (crew#1057).
+            const callersRef = err instanceof UnresolvableDiffBaseError && err.base !== MERGE_BASE_LITERAL;
+            if (!callersRef && !worktreeIntact())
                 return fromBranchOr409();
             return diffError(err);
         }
@@ -3711,12 +3753,14 @@ runtime = {}) {
             // detection (issue #419) — otherwise a gate served from the durable row after a restart would
             // silently drop the warning that the live/replay paths carry.
             const refusal = detectRefusal(durableGate.prompt);
+            const gateKind = typeof durableGate['gate_kind'] === 'string' && durableGate['gate_kind'] !== '' ? durableGate['gate_kind'] : undefined;
             const entry = {
                 ord: durableGate.ord ?? 0,
                 prompt: durableGate.prompt,
                 lifecycle: 'open',
                 receivedAt: new Date(durableGate.created_at).toISOString(),
                 ...(refusal !== undefined ? { refusal } : {}),
+                ...(gateKind !== undefined ? { gateKind } : {}),
             };
             gateCache.adopt(id, entry);
             return entry;
@@ -4021,6 +4065,26 @@ runtime = {}) {
             return reply.code(409).send({ error: message(err) });
         }
     });
+    /** crew#1058: the runs with a gated reassign (re-seat, then approve) in flight — one at a time. */
+    const gatedReassigns = new Set();
+    /**
+     * codex r1 on #1060: whether approving the run's open gate ACCEPTS the parked unit's work rather
+     * than re-running it (wicked-core `confirm_gate`: a `judge_unavailable` / `qe_reviewer_unavailable`
+     * denial on the cursor unit is judged by the operator; an open `review_adjudication` gate lands
+     * with carried items). Says what the approve does, or `null` when it re-runs the unit.
+     */
+    async function approveAcceptsWork(run, ord) {
+        const unit = run.units.find((u) => u.ord === ord);
+        const denial = unit?.denial;
+        if (unit?.status === 'rejected' && (denial?.source === 'judge_unavailable' || denial?.source === 'qe_reviewer_unavailable')) {
+            return 'is the operator\'s judgment of the work as it stands (no judge could rule)';
+        }
+        const open = await resolveOpenGate(run.session.id).catch(() => null);
+        if (open !== null && open !== 'no-log' && open.gateKind === 'review_adjudication') {
+            return 'lands the reviewed work with its carried items';
+        }
+        return null;
+    }
     // The manual operator lever (crew#442): recycles a run's CURSOR unit via the same
     // `adapter.reassignUnit` path the stall-watchdog's automatic escalation uses, for when a
     // wedged unit needs recovering and auto-escalation is off, exhausted, or itself failed. Scoped
@@ -4037,17 +4101,16 @@ runtime = {}) {
         if (!run)
             return reply.code(404).send({ error: 'Run not found' });
         // Wave 6 (F-7R2-007 root fix): a run PARKED at a gate on a dead seat — the stall watchdog's
-        // escalation gate, or a verdict escalation — used to answer 409 here, so the studio's control
-        // needed two calls (approve, then race the engine's re-dispatch of the same dead seat with a
-        // reassign). The ENGINE's `reassign_unit` accepts ONLY an Executing run (wicked-core actor.rs:
-        // "run X is not Executing (status: AwaitingHuman)") — there is no reassign-in-place for a gated
-        // run — so this route performs APPROVE-THEN-REASSIGN in one call: the approve resumes the run
-        // (the engine re-dispatches the cursor unit to its current seat), and the reassign IMMEDIATELY
-        // supersedes that turn (cancels its epoch, closes the seat's session, bumps the attempt) and
-        // re-dispatches to the requested seat or the council's pick. The dead seat is dispatched for
-        // the gap between the two engine calls — a bounded window the engine contract leaves open (a
-        // reassign-as-approval engine op would close it; documented in the PR). Audited as BOTH a gate
-        // decision (`via: 'reassign'`) and a reassign, so the "who approved" trail has no side door.
+        // escalation gate, or a verdict escalation — is reassigned and approved in ONE call. crew#1058:
+        // with a named seat it is REASSIGN-THEN-APPROVE. The engine re-seats a parked run's cursor unit
+        // without dispatching it (wicked-core#773, `reseat_parked_unit`, core-ts >= 0.13.0) and refuses
+        // a seat it cannot honour (an author's seat for a review under a distinct-evaluator contract,
+        // a ballot-only seat, a held plan) with the run untouched, so a refusal is a 409 with the gate
+        // still open; the approve then dispatches the unit once, on the new seat. The old order
+        // (approve, then reassign) approved first, so a refused reassign left the failed seat running
+        // again. Without a named seat (the council's pick) the engine needs a running unit to re-route,
+        // so that path stays approve-then-reassign. Audited as BOTH a gate decision
+        // (`via: 'reassign'`) and a reassign, so the "who approved" trail has no side door.
         // A steering-author propose gate is NOT approvable this way: its approve LANDS the proposal
         // through `POST /runs/:id/gate` (crew#388), and a reassign is not a review of the rules.
         const gated = run.session.status === 'awaiting_human';
@@ -4090,21 +4153,69 @@ runtime = {}) {
         }
         const cursor = resolveCursorUnit(run);
         const ord = cursor?.ord ?? run.session.unit_ix;
-        try {
-            if (gated) {
-                const who = actorOf(req);
-                adapter.recordGateActor?.(id, `${who.id} (${who.kind})`);
-                const status = await adapter.confirmGate(id, true);
-                audit.record('gate.decided', actorOf(req), {
-                    runId: id,
-                    detail: { approve: true, via: 'reassign', status },
-                });
-            }
-            await adapter.reassignUnit(id, ord, requestedCli ?? null);
+        const approve = async () => {
+            if (typeof adapter.confirmGate !== 'function')
+                return; // refused above for a gated run
+            const who = actorOf(req);
+            adapter.recordGateActor?.(id, `${who.id} (${who.kind})`);
+            const status = await adapter.confirmGate(id, true);
+            audit.record('gate.decided', actorOf(req), {
+                runId: id,
+                detail: { approve: true, via: 'reassign', status },
+            });
+        };
+        const reassigned = (approved) => {
             audit.record('run.reassigned', actorOf(req), {
                 runId: id,
-                detail: { ord, ...(requestedCli !== undefined ? { cli: requestedCli } : {}), ...(gated ? { approved: true } : {}) },
+                detail: { ord, ...(requestedCli !== undefined ? { cli: requestedCli } : {}), ...(gated ? { approved } : {}) },
             });
+        };
+        if (gated && requestedCli !== undefined) {
+            // codex r1 on #1060: an approve that ACCEPTS the parked work instead of re-running the unit —
+            // a `judge_unavailable` / `qe_reviewer_unavailable` denial (the operator judges, the unit
+            // counts) or a `review_adjudication` gate (lands with carried items) — must not follow a
+            // re-seat: the new seat would be recorded on work it never did, and never run.
+            const accepts = await approveAcceptsWork(run, ord);
+            if (accepts !== null) {
+                return reply.code(409).send({
+                    error: `run ${id} is parked at a gate whose approve ${accepts}, so a reassign would not run unit ${ord} on '${requestedCli}' — approve, send back or stop it via POST /runs/${id}/gate. Nothing was changed.`,
+                });
+            }
+            // codex r1 on #1060: the re-seat and the approve are two engine commands; a second reassign of
+            // the same run between them would dispatch a seat neither response names.
+            if (gatedReassigns.has(id)) {
+                return reply.code(409).send({ error: `a reassign of run ${id} is already in flight. Nothing was changed.` });
+            }
+            gatedReassigns.add(id);
+            try {
+                try {
+                    await adapter.reassignUnit(id, ord, requestedCli);
+                }
+                catch (err) {
+                    // The engine refused the seat with the run untouched: nothing was approved.
+                    return reply.code(409).send({ error: `${message(err)}. Nothing was approved; the gate is still open.` });
+                }
+                try {
+                    await approve();
+                }
+                catch (err) {
+                    reassigned(false);
+                    return reply.code(409).send({
+                        error: `unit ${ord} was re-seated on ${requestedCli}, but approving the gate failed: ${message(err)} — read the run's gate before answering again`,
+                    });
+                }
+                reassigned(true);
+                return reply.send({ status: 'ok', ord, cli: requestedCli, approved: true });
+            }
+            finally {
+                gatedReassigns.delete(id);
+            }
+        }
+        try {
+            if (gated)
+                await approve();
+            await adapter.reassignUnit(id, ord, requestedCli ?? null);
+            reassigned(true);
             return reply.send({
                 status: 'ok',
                 ord,
@@ -5768,15 +5879,13 @@ runtime = {}) {
     //   { outcome:'handed_off', payload, landing }     — a POLICY proposal, LANDED here as a steering rule.
     //
     // The policy→steering landing (DES-MEM-FACETED-001 §5.2): estate performs NO rules-write (the
-    // AW-11 invariant) — it marks the proposal approved and hands its `{ rule, severity }` payload
-    // back, and CREW is the one governed rules-write path. On a `handed_off` outcome we recover the
-    // proposal's `kind_type` (which carries the `policy:<steering_type>` the approve response does
-    // NOT echo), shape a `ConformanceRule` from it, and upsert it via the single-writer actor. The
-    // posture mirrors the steering-author landing (crew#388): the estate decision (approve) already
-    // stands, so a landing failure is reported LOUD in-band as `landing.outcome:"failed"` — never a
-    // 500, never the silent no-op that crew#388 exists to end — and `payload` is still returned for
-    // backward compatibility. The MEMORY path is UNTOUCHED: a `promoted` outcome returns immediately
-    // with no extra estate call and no landing.
+    // AW-11 invariant) — CREW is the one governed rules-write path. The route reads the pending row
+    // (its `kind_type` carries the `policy:<steering_type>`), shapes a `ConformanceRule` from it,
+    // upserts it via the single-writer actor, and only THEN asks estate to mark the proposal
+    // approved. A landing failure is reported LOUD in-band as `landing.outcome:"failed"` (never a
+    // 500, never the silent no-op crew#388 exists to end) and leaves the proposal PENDING, so it can
+    // be approved again; an approve estate refuses after the rule landed retires the rule. A MEMORY
+    // proposal is passed straight to estate's approve.
     app.post(`${V}/proposals/:id/approve`, {
         config: {
             manifest: {
@@ -5800,9 +5909,38 @@ runtime = {}) {
         if (!edit.success) {
             return reply.code(400).send(invalidBody(edit.error, 'Invalid approve body'));
         }
-        if (edit.data.content !== undefined || edit.data.reach !== undefined) {
+        // A POLICY proposal accepted with a `reach` (no content) is not a copy: crew lands the rule
+        // itself, so the person's reach rides into the landing below (the policy landing reads it).
+        let policyReach;
+        // The pending read the accept-with-edit makes anyway, done once and shared with it.
+        let editTool = estateTool;
+        if (edit.data.content === undefined && edit.data.reach !== undefined) {
+            let listed;
+            try {
+                listed = (await estateTool('proposal.list', { state: 'pending' }));
+            }
+            catch (err) {
+                return estateUpstreamError(reply, err);
+            }
+            let reused = false;
+            editTool = async (tool, args) => {
+                if (!reused && tool === 'proposal.list' && args['state'] === 'pending') {
+                    reused = true;
+                    return listed;
+                }
+                return estateTool(tool, args);
+            };
+            const kind = listed.proposals.find((p) => p.id === id)?.kind_type;
+            if (typeof kind === 'string' && kind.startsWith('policy:')) {
+                if (edit.data.reach === 'pattern') {
+                    return reply.code(400).send({ error: 'a rule\'s reach is "project" (its project) or "operator" (every project)' });
+                }
+                policyReach = edit.data.reach;
+            }
+        }
+        if (policyReach === undefined && (edit.data.content !== undefined || edit.data.reach !== undefined)) {
             try {
-                const done = await approveEdited(estateTool, id, edit.data, (runId) => projects.index.projectOf(runId));
+                const done = await approveEdited(editTool, id, edit.data, (runId) => projects.index.projectOf(runId));
                 return reply.code(done.status).send(done.body);
             }
             catch (err) {
@@ -5812,6 +5950,18 @@ runtime = {}) {
         if (editInFlight(id)) {
             return reply.code(409).send({ error: `proposal ${id} is already being accepted` });
         }
+        // Read the pending row FIRST: a POLICY proposal is landed before estate marks it approved, so
+        // a landing that fails leaves it pending and re-approvable (one decision from the operator's
+        // view: approved WITH its rule, or still pending). The row also carries the `kind_type`
+        // (`policy:<steering_type>`), facets and provenance the approve response does not echo.
+        let row;
+        try {
+            const pending = (await estateTool('proposal.list', { state: 'pending' }));
+            row = pending.proposals.find((p) => p.id === id);
+        }
+        catch (err) {
+            return estateUpstreamError(reply, err);
+        }
         // DC-S4a: a proposal THIS ledger filed for a decision lands through `remember()` — the one
         // landing path, with the human check inside it (§4.5). A payload naming an id the ledger does
         // not know is an ordinary policy proposal (no ORIGIN claim) and takes the path below.
@@ -5820,24 +5970,22 @@ runtime = {}) {
             // The ledger links a proposal to its decision only once the `offered` outcome is written; a
             // proposal crew filed but has not linked yet (the publish window, or a crash in it) names a
             // decision this ledger HOLDS — it must still land through `remember()` (codex on DC-S4a).
-            try {
-                const pending = (await estateTool('proposal.list', { state: 'pending' }));
-                const named = pending.proposals.find((p) => p.id === id)?.payload?.decision?.id;
-                if (typeof named === 'string' && decisions.deps.ledger.record(named) !== null)
-                    decisionId = named;
-            }
-            catch (err) {
-                return estateUpstreamError(reply, err);
-            }
+            const named = row?.payload?.decision?.id;
+            if (typeof named === 'string' && decisions.deps.ledger.record(named) !== null)
+                decisionId = named;
         }
         if (decisions !== null && decisionId !== null) {
             try {
-                const landed = await decisions.remember(decisionId, actorOf(req), { how: 'needs-you' });
+                const landed = await decisions.remember(decisionId, actorOf(req), {
+                    how: 'needs-you',
+                    ...(policyReach !== undefined ? { edits: { scope: policyReach === 'operator' ? 'everywhere' : 'project' } } : {}),
+                });
                 const view = decisions.deps.ledger.view(decisionId);
                 const landing = {
                     outcome: 'landed',
                     ruleId: landed.rule_id,
                     ...(view !== null ? { steering_type: view.edits?.steering_type ?? view.derived.steering_type } : {}),
+                    reach: landed.project !== undefined ? 'project' : 'operator',
                     ...(landed.project !== undefined ? { project: landed.project } : {}),
                 };
                 return {
@@ -5852,50 +6000,50 @@ runtime = {}) {
                 throw err;
             }
         }
-        let approved;
-        try {
-            approved = (await estateTool('proposal.approve', { id }));
-        }
-        catch (err) {
-            return estateUpstreamError(reply, err);
-        }
-        // MEMORY proposal (or any future non-policy outcome): estate already promoted it — pass through
-        // verbatim, exactly as before. No extra estate round-trip on the memory path.
-        if (approved.outcome !== 'handed_off') {
+        // Not a pending POLICY proposal (a memory, a knowledge row, or an id that is not pending, which
+        // estate refuses in its own words): estate decides it — pass through verbatim.
+        if (row === undefined || typeof row.kind_type !== 'string' || !row.kind_type.startsWith('policy:')) {
+            let approved;
+            try {
+                approved = (await estateTool('proposal.approve', { id }));
+            }
+            catch (err) {
+                return estateUpstreamError(reply, err);
+            }
+            if (approved.outcome === 'handed_off') {
+                // Estate handed off a policy this route did not see pending (a row filed between the list
+                // and the approve): it is approved with no rule. Say so; never a silent drop.
+                const error = `estate approved policy proposal ${id} before crew could land its rule; land it by hand via ` +
+                    `POST ${V}/governance/rules`;
+                audit.record('governance.steering.landing_failed', actorOf(req), { detail: { proposalId: id, error } });
+                return { outcome: 'handed_off', payload: approved.payload, landing: { outcome: 'failed', error } };
+            }
             return approved;
         }
-        // POLICY proposal — land the handed-off payload as a steering rule.
+        // POLICY proposal — land the rule, THEN approve it in estate.
+        const policyRow = { ...row, kind_type: row.kind_type };
         const landFailed = (error) => {
             audit.record('governance.steering.landing_failed', actorOf(req), {
                 detail: { proposalId: id, error },
             });
-            return { outcome: 'handed_off', payload: approved.payload, landing: { outcome: 'failed', error } };
+            // Nothing was approved: the proposal is still pending, so the operator can approve it again.
+            return {
+                outcome: 'handed_off',
+                payload: policyRow.payload,
+                landing: { outcome: 'failed', error: `${error} (the proposal is still pending)` },
+            };
         };
         // A pre-steering engine would SILENTLY DROP `steering_type` and the other steering fields
         // (ConformanceRule has no deny_unknown_fields), persisting a rule that enforces differently than
-        // authored — the same guard POST /governance/rules applies. Fail loud (before any further estate
-        // round-trip), persist nothing.
+        // authored — the same guard POST /governance/rules applies. Fail loud, persist nothing.
         if (!adapter.steeringSupported()) {
             return landFailed(`${new SteeringUnsupportedError('Landing an approved policy proposal').message} — the ` +
                 `installed engine would silently drop the rule's steering fields; upgrade wicked-core-ts (>= 0.7.5)`);
         }
-        // Recover the proposal's `kind_type` + `facets`: `proposal.approve` does not echo them, and the
-        // steering type lives ONLY in `kind_type` (`policy:<type>`). The proposal is `approved` now, so
-        // read it back from the approved queue.
-        let proposal;
-        try {
-            const listed = (await estateTool('proposal.list', { state: 'approved' }));
-            proposal = listed.proposals.find((p) => p.id === id);
-        }
-        catch (err) {
-            return landFailed(`the policy proposal was approved but its record could not be re-read to land a steering ` +
-                `rule (${message(err)}); land it by hand via POST ${V}/governance/rules`);
-        }
-        if (proposal === undefined || typeof proposal.kind_type !== 'string') {
-            return landFailed(`the policy proposal was approved but could not be found in the approved queue to recover ` +
-                `its steering type; land it by hand via POST ${V}/governance/rules`);
-        }
-        const built = policyProposalToRule(id, proposal.kind_type, approved.payload, isStringRecord(proposal.facets) ? proposal.facets : undefined);
+        // A proposal with no `project` facet keeps the project of the run that filed it.
+        const runId = policyRow.provenance?.['run_id'];
+        const runProject = typeof runId === 'string' && runId !== '' ? projects.index.projectOf(runId) : undefined;
+        const built = policyProposalToRule(id, policyRow.kind_type, policyRow.payload, isStringRecord(policyRow.facets) ? policyRow.facets : undefined, { ...(runProject !== undefined ? { runProject } : {}), ...(policyReach !== undefined ? { reach: policyReach } : {}) });
         if ('error' in built) {
             return landFailed(built.error);
         }
@@ -5906,7 +6054,22 @@ runtime = {}) {
         });
         if (landing.outcome === 'failed')
             return landFailed(landing.error ?? 'the landing failed');
-        return { outcome: 'handed_off', payload: approved.payload, landing };
+        // The rule is in the store: now mark the proposal approved. An approve estate does not confirm
+        // is an upstream error and nothing is undone — estate may have committed it, and a concurrent
+        // approve may share the rule. The proposal is then pending with its rule live (the same state a
+        // crash here leaves): approving again re-lands the same rule id and finishes; rejecting it
+        // retires the rule (see the reject route).
+        let approved;
+        try {
+            approved = (await estateTool('proposal.approve', { id }));
+        }
+        catch (err) {
+            audit.record('governance.steering.landing_failed', actorOf(req), {
+                detail: { proposalId: id, ruleId: built.rule.id, error: `rule landed; estate did not confirm the approval: ${message(err)}` },
+            });
+            return estateUpstreamError(reply, err);
+        }
+        return { outcome: 'handed_off', payload: approved.outcome === 'handed_off' ? approved.payload : policyRow.payload, landing };
     });
     // POST /proposals/:id/reject → proposal.reject → { ok: true }.
     app.post(`${V}/proposals/:id/reject`, 
@@ -5932,12 +6095,19 @@ runtime = {}) {
                 throw err;
             }
         }
+        let rejected;
         try {
-            return (await estateTool('proposal.reject', { id }));
+            rejected = (await estateTool('proposal.reject', { id }));
         }
         catch (err) {
             return estateUpstreamError(reply, err);
         }
+        // A policy proposal's rule lands before its approval, so a still-pending proposal may already
+        // have a live rule (a crash or an unconfirmed approve in between): rejecting it withdraws it.
+        const withdrawn = await withdrawLandedRule(adapter, id.trim());
+        if (withdrawn !== null)
+            return reply.code(502).send({ error: withdrawn });
+        return rejected;
     });
     // ── Memory management (governed-knowledge surface, DES-MEM-FACETED-001) ───────
     // Browse + retire the EXISTING operator memory store — the studio counterpart to /proposals:
@@ -6146,6 +6316,175 @@ runtime = {}) {
             return estateUpstreamError(reply, err);
         }
     });
+    // POST /memory/edit { memory_id, content } → memory.list (find it) → memory.capture (the new words,
+    // the old tier/scope/facets) → memory.erase { id: old } → { memory_id: new, retired: old }.
+    // estate has no in-place update and no transaction across tools, so an edit is a replacement made in
+    // steps. Erase-by-id is probed BEFORE anything is written (an id no memory has, so nothing is deleted):
+    // an estate without it answers 501 with nothing changed. After a write, any step that does not answer
+    // as expected is reconciled by re-reading the store, never assumed: a replacement that landed is a
+    // 200; a new copy beside a surviving old memory is taken back out (and checked); whatever remains is
+    // named in the 502.
+    app.post(`${V}/memory/edit`, {
+        config: {
+            manifest: {
+                requestType: 'EditMemoryBody',
+                responseType: 'EditMemoryResponse',
+                statusCodes: [200, 400, 404, 409, 501, 502],
+            },
+        },
+    }, async (req, reply) => {
+        const parsed = EditMemorySchema.safeParse(req.body);
+        if (!parsed.success) {
+            return reply.code(400).send(invalidBody(parsed.error, 'Invalid edit request'));
+        }
+        const memoryId = parsed.data.memory_id.trim();
+        const content = parsed.data.content.trim();
+        if (memoryId === '')
+            return reply.code(400).send({ error: '`memory_id` must not be empty' });
+        if (content === '')
+            return reply.code(400).send({ error: '`content` must not be empty' });
+        if (memoryEditsInFlight.has(memoryId)) {
+            return reply.code(409).send({ error: `memory ${memoryId} is already being edited` });
+        }
+        memoryEditsInFlight.add(memoryId);
+        // Every estate call here is crew's own (no client argument reaches estate unchecked), so an
+        // estate refusal is an upstream fault: 502, never the 400 `estateUpstreamError` gives -32602.
+        const upstream = (what, err) => reply.code(502).send({ error: `${what}: ${message(err)}` });
+        const listAll = async () => {
+            const raw = await estateTool('memory.list', {});
+            const items = typeof raw === 'object' && raw !== null ? raw['items'] : undefined;
+            if (!Array.isArray(items))
+                throw new EstateMcpError('memory.list returned an unexpected shape');
+            return items.map(shapeMemoryItem);
+        };
+        const deletedCount = (raw) => (typeof raw === 'object' && raw !== null ? raw['deleted_count'] : undefined);
+        try {
+            // 1. The memory as it is: its tier, scope and facets ride onto the replacement.
+            let before;
+            try {
+                before = await listAll();
+            }
+            catch (err) {
+                return upstream('reading the memory store failed; nothing changed', err);
+            }
+            const old = before.find((m) => m.id === memoryId);
+            if (old === undefined)
+                return reply.code(404).send({ error: `no memory ${memoryId}` });
+            if (old.content.trim() === content) {
+                return reply.code(400).send({ error: 'the new words are the same as the memory\'s; nothing to change' });
+            }
+            // 2. Erase-by-id must exist before anything is written (wicked-estate#188). The probe names an
+            //    id no memory carries, so it deletes nothing.
+            try {
+                await estateTool('memory.erase', { id: MEMORY_EDIT_PROBE_ID });
+            }
+            catch (err) {
+                if (err instanceof EstateMcpError && err.code === -32602 && ESTATE_NO_ERASE_BY_ID.test(err.message)) {
+                    return reply.code(501).send({
+                        error: 'this wicked-estate cannot erase one memory by id (it needs wicked-estate#188), so it cannot replace one; nothing changed',
+                        code: 'estate_upgrade_required',
+                    });
+                }
+                return upstream('checking that the store can erase one memory failed; nothing changed', err);
+            }
+            // 3. The new words, as a new memory in the old one's place.
+            const captureArgs = { content, scope: old.scope, facets: old.facets };
+            if (old.tier !== '') {
+                captureArgs['tier'] = old.tier;
+                const kind = KIND_FOR_TIER[old.tier];
+                if (kind !== undefined)
+                    captureArgs['kind'] = kind;
+            }
+            const beforeIds = new Set(before.map((m) => m.id));
+            let newId = null;
+            let captureErr = null;
+            try {
+                const captured = await estateTool('memory.capture', captureArgs);
+                const id = typeof captured === 'object' && captured !== null ? captured['memory_id'] : undefined;
+                if (typeof id === 'string' && id !== '')
+                    newId = id;
+                else
+                    captureErr = new EstateMcpError('memory.capture returned no memory_id');
+            }
+            catch (err) {
+                captureErr = err;
+            }
+            if (newId === null) {
+                // The capture may still have written (a lost answer): look before saying nothing changed.
+                let now;
+                try {
+                    now = await listAll();
+                }
+                catch (err) {
+                    return reply.code(502).send({
+                        error: `writing the new words did not answer as expected (${message(captureErr)}) and the store could not be re-read (${message(err)}); a copy of the new words may exist beside ${memoryId}`,
+                    });
+                }
+                const copies = now.filter((m) => !beforeIds.has(m.id) && m.content.trim() === content && m.scope === old.scope);
+                if (copies.length !== 1) {
+                    return reply.code(502).send({
+                        error: copies.length === 0
+                            ? `writing the new words failed (${message(captureErr)}); nothing changed`
+                            : `writing the new words did not answer as expected (${message(captureErr)}); ${copies.length} copies of them now exist beside ${memoryId}: ${copies.map((m) => m.id).join(', ')}`,
+                    });
+                }
+                newId = copies[0].id;
+            }
+            // 4. The old memory out.
+            let eraseErr = null;
+            let deleted;
+            try {
+                deleted = deletedCount(await estateTool('memory.erase', { id: memoryId }));
+            }
+            catch (err) {
+                eraseErr = err;
+            }
+            if (eraseErr === null && deleted === 1) {
+                const body = { memory_id: newId, retired: memoryId };
+                return body;
+            }
+            const why = eraseErr !== null ? `retiring ${memoryId} failed (${message(eraseErr)})` : `retiring ${memoryId} removed ${String(deleted)} memories, expected 1`;
+            // 5. Reconcile: what is in the store now decides the answer, never the failed call.
+            const present = async () => new Set((await listAll()).map((m) => m.id));
+            let ids;
+            try {
+                ids = await present();
+            }
+            catch (err) {
+                return reply.code(502).send({ error: `${why}, and the store could not be re-read (${message(err)}); ${newId} was written and ${memoryId} may remain` });
+            }
+            if (!ids.has(memoryId) && ids.has(newId)) {
+                // The retire landed even though its answer did not: the edit is complete.
+                const body = { memory_id: newId, retired: memoryId };
+                return body;
+            }
+            if (!ids.has(newId)) {
+                return reply.code(502).send({ error: ids.has(memoryId) ? `${why}; nothing changed` : `${why}; neither ${memoryId} nor ${newId} is in the store now` });
+            }
+            // Both are there: take the new copy back out, then check that it is gone.
+            try {
+                await estateTool('memory.erase', { id: newId });
+            }
+            catch {
+                // Checked below: the store, not the call, says whether it is gone.
+            }
+            try {
+                ids = await present();
+            }
+            catch (err) {
+                return reply.code(502).send({ error: `${why}; taking ${newId} back out could not be checked (${message(err)}), so both ${memoryId} and ${newId} may remain` });
+            }
+            return reply.code(502).send({
+                error: ids.has(newId) ? `${why}; taking ${newId} back out failed, so both ${memoryId} and ${newId} remain` : `${why}; the new copy was taken back out, so nothing changed`,
+            });
+        }
+        catch (err) {
+            return upstream('editing the memory failed', err);
+        }
+        finally {
+            memoryEditsInFlight.delete(memoryId);
+        }
+    });
     // ── Projects (DES-PROJECT-001) — the 9-route experience-plane surface ────────
     registerProjectRoutes(app, adapter, { ...projects, settings: projectSettings }, security);
     // crew#371: a project's requirements / domain / coverage, folded over its repos' own reads.